Man-in-the-middle-attacks via ARP spoofing using Ettercap. April 29, 2015 presentation for Tennessee Tech CyberEagles Club

1. MITM ATTACK WITH ETTERCAP
TennesseeTech CyberEagles Club

2. ARP
• Address Resolution Protocol
• RFC 826 (1982)
• “IP Address to MAC Address for Ethernet”
• Request <=> Reply
• Response is cached

3. ARP - PROBLEMS
• Entries are simple mappings
• Stateless
• No authentication
• Ethernet stack depends heavily on ARP

4. ARP SPOOFING
• Client in a network sends
spoofed ARP messages
• Other clients update their
ARP mappings
• Traffic is sent to the
malicious client
Wikipedia: 0x55534C

5. ETTERCAP
“Ettercap is a comprehensive suite for man in the middle
attacks. It features sniffing of live connections, content filtering
on the fly and many other interesting tricks. It supports active
and passive dissection of many protocols and includes many
features for network and host analysis.”
www.ettercap-project.org

6. ETTERCAP
• Open Source;Works on *nix
• Provides (almost) everything required for a MITM
attack
• Scan,Attack, Capture, Filter, Restore, …
• MITM:ARP Poisoning, ICMP Redirection, DHCP
Spoofing, Port Stealing, …

7. FILTERS AND PLUGINS
• Filters
• search, regex, replace, log, drop, exec, inject, …
• C-like Syntax; Compiled
• Plugins
• Provide Extended Functionality
• Bundled: DNS Spoof, autoadd, sslstrip, …

8. DEMOTIME
• TwoVirtualbox Machines: Elementary OS and
Ubuntu
• NAT Network to simulate a real LAN
environment
• DigitalOcean instance for “phishing”

9. DEFENSES
• Static ARP
• Physical Security
• ArpON,ARPDefender, …
• Encryption: HTTPS (HSTS),TLS, …

10. {twitter,github}.com/shritesh
ThankYou!!!